If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.

ForceField and "_ISW_RESTRICTED_GROUP_"

Hey. Few days ago i noticed that some of my personal folders are shared to internet (I use Vista) and i watched folder users and there was "_ISW_RESTRICTED_GROUP_". When I googled it, almost all pages informed that it have something to do with ZoneAlarm. Is my firewall program really sharing my folders or is this possible some kind of vulnerability?

Im using Windows Vista (SP2) and newest ZoneAlarm. ZoneAlarm also have been reporting a lot lately that it have blocked incoming connections that use port 22. I dont run any server or shell or irc programs in this computer, so what are these all the time incoming connections that use port 22?

Re: Why is ZoneAlarm sharing my folders

Hi!
I think the best is to contact ZA support directly. I have only seen a post in here referring to it from last year with no other users answering. Link to support in my signature. Let us know if you get any insights

Re: Why is ZoneAlarm sharing my folders

Originally Posted by fax

Hi!
I think the best is to contact ZA support directly. I have only seen a post in here referring to it from last year with no other users answering. Link to support in my signature. Let us know if you get any insights

Cheers,
Fax

Hey. Where/how I can do that? I tried to find some support email address but didnt have much luck.

Re: Why is ZoneAlarm sharing my folders

: "_ISW_RESTRICTED_GROUP_" is created by the browser security features in ZA ForceField. It is part of the virtualization processes. This folder is not shared over the internet however."

: That group is created by ForceField. This is a special group with restricted rights which is used to run virtualized processes. It used to limit permissions of virtualized process, so it will not be able to damage system even if it bypasses our hooks. Files saved directly by virtualized processes (e.g. by using Save As or favorites created by IE) will have this group in the list of owners. It shouldn’t be a problem for user (other than seeing it in the list of groups in file properties). We haven’t seen any bugs about it."

And he also told that ZoneAlarm should block windows file sharing automatically even if windows is showing that files are shared, so Im guessing that there is no problem then.

Kind weird though because i never had shared my personal folders (there where no other folders shared to internet) or downloaded anything to them from internet, those folders are in two different hard drive and most of those folders just contain my documents. And when i disable file sharing from those folders, it soon get enabled itself. So i guess i just have to trust that zonealarm firewall dont allow them to be shared to internet though windows is trying to do so for some reason

And i read that port 22 can be used to hacking, but i guess it dont have anything to do with this case because zonealarm said that it blocked those connections that used port 22.

Re: Why is ZoneAlarm sharing my folders

So i guess i just have to trust that zonealarm firewall dont allow them to be shared to internet even that windows is trying to do so for some reason

Thank you for posting the answer from support. This clarify the issue related to that folder.

Note that ZA takes overs on PC resources sharing, you need to configure it properly to allow or not allow sharing (via the ZA firewall section --> Internet and Trusted zones). Whatever is "internet" has not unattended access to your PC.